A synchroniser assumes its clock keeps ticking. A gated clock does not. The moment either side of a crossing can stop, the protocol must survive the stall, or the first idle period wedges the link permanently.
Situation | Failure |
|---|---|
Destination clock stopped | A pulse arrives and leaves while nobody samples; a level sits unsynchronised until the clock returns, then crosses late. Late is tolerable only where the protocol holds the request until it is acknowledged; otherwise the lateness is itself a failure. |
Source clock stopped mid-handshake | The request freezes; the destination already answered or is still waiting. A two-phase link resumes correctly; a careless four-phase controller can double-issue. |
Destination clock stopped mid-handshake | The acknowledge never returns. The source waits forever unless it has a timeout or a wake-up path, which is a deadlock by another name. |
Both clocks stopped | FIFO pointers freeze on both sides; full and empty flags go stale. Resumption is correct only if nothing was sampled mid-update. |
The synchroniser flops' clocks, or the stall tolerance. Either keep the synchroniser chain on a free-running clock (ungated or parent) while the gated logic sleeps, or use a protocol that holds its request until the acknowledge returns, however long that takes.
The acknowledge path. A handshake whose acknowledge logic sleeps with the destination clock cannot complete. Route the acknowledge through logic that wakes with, or before, the destination.
The wake-up ordering. The common pattern is: request arrives, idle detection wakes the gated domain, the clock restarts, the synchroniser chain (kept alive or given flush cycles) delivers the request, the acknowledge returns. Skipping the flush delivers a stale value as if it were the new request.
In practice this means the synchroniser chain usually sits outside the gated region, on the parent or free-running clock, while only the consuming logic sleeps. The chain costs a few flops of always-on power and buys a link that cannot wedge.
Simulate the stall explicitly: gate the clock for hundreds of cycles mid-transfer, in both directions, with requests pending each way, and check that every request eventually completes exactly once. Structural analysis cannot see a stopped clock, so this behaviour is demonstrated by stall simulation in both directions plus review, not by the CDC report.
Something outside the stalled handshake: the request itself (or its synchronised copy on a live clock) must feed the idle-detection or wake-up logic. If nothing watches the request while the clock is still, the link waits forever.